Wireless Penetration Testing CPENT Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   You have successfully cracked the WPA2-PSK passphrase of a corporate wireless network and connected your laptop. You need to perform post-exploitation enumeration, but you want to avoid detection by the network's intrusion detection system (IDS). Which approach would be the most stealthy for host discovery?

   • AUse tcpdump to passively capture traffic and identify hosts from ARP and DHCP traffic.
   • BUse arp-scan to discover hosts on the local subnet.
   • CUse a ping sweep with ICMP echo requests.
   • DUse nmap with the -sS (SYN stealth) scan against the entire subnet.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During a red-team engagement, you need to capture credentials from employees connecting to the corporate Wi-Fi. The corporate network uses WPA2-Enterprise with PEAP-MSCHAPv2. You set up an evil twin AP with the same SSID and a captive portal that mimics the corporate login page. What additional step is essential to force clients to connect to your rogue AP?

   • ASend deauthentication frames to clients connected to the legitimate AP.
   • BUse a stronger antenna to increase the signal range of the rogue AP.
   • CConfigure the rogue AP to use the same channel as the legitimate AP.
   • DEnable WPA2-PSK on the rogue AP to match the corporate encryption.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is an evil twin attack in wireless penetration testing?

   • AAn attacker clones a client's MAC address to bypass MAC filtering
   • BAn attacker captures the 4-way handshake by placing a sniffer near the target AP
   • CAn attacker sends deauthentication frames to disconnect all clients from the network
   • DAn attacker sets up a rogue access point with the same SSID as a legitimate network to trick clients into connecting
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which wireless security protocol introduced the Simultaneous Authentication of Equals (SAE) handshake to provide forward secrecy and resistance to offline dictionary attacks?

   • AWPA
   • BWEP
   • CWPA2
   • DWPA3
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   You are testing a small office that uses a WPA2-PSK network. The access point has WPS enabled with default settings. Your initial attempt to brute-force the WPS PIN using reaver fails after several PIN attempts, and the AP stops responding to WPS probes. What is the most likely cause and the appropriate next step?

   • AThe AP has a WPS lockout; wait for the lockout period to expire, then resume the attack with a slower timing.
   • BThe AP is using WPA3; WPS is not available, so you must attack the SAE handshake.
   • CYour wireless card does not support packet injection; use a different adapter.
   • DThe WPS PIN is not vulnerable; switch to cracking the WPA2 handshake with a dictionary.
   Reveal Solution Discussion Select an answer first